CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in Meks Video Importer, Meks Time Ago, Meks ThemeForest Smart Widget, Meks Smart Author Widget, Meks Audio Player, Meks Easy Maps, Meks Easy Photo Feed Widget, Meks Simple Flickr Widget, Meks Easy Ads Widget, Meks Smart Social Widget plugins leading to dismiss or the popup.
Explanation of Vulnerability in Simple Terms
Meks Video Importer versions up to 1.0.10 contain a cross-site request forgery (CSRF) vulnerability. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unwanted actions within the plugin without the admin's knowledge or consent. The vulnerability requires user interaction—the admin must visit the attacker's page while authenticated.
What an attacker can do
Perform unwanted actions in the plugin on behalf of a logged-in administrator.
Potential impact on your site
An attacker can trick your admin into unknowingly changing plugin settings or importing malicious video content.
Conditions required to exploit
Administrator must visit an attacker-controlled webpage while logged into the site.
Key dates
External resources
Related vulnerabilities
